Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet… (CVE-2026-109396)

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability (CWE-1236) that permits unauthenticated attackers to inject spreadsheet formulas by submitting crafted input fields such as names, addresses, or phone numbers starting with characters like '=', '+', '-', or '@'. The CSVSerializer exports these inputs verbatim, causing formula execution in the administrator's spreadsheet software upon opening the exported CSV file.

An attacker can cause spreadsheet formulas to execute in the context of the administrator's spreadsheet application when opening exported CSV files. This may lead to limited confidentiality and integrity impacts, such as data leakage or manipulation within the spreadsheet environment. The CVSS score is 4.2 (low severity), indicating limited impact and requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should be cautious when opening CSV files exported from Thelia, especially those containing user-supplied data. Consider sanitizing or validating input fields to prevent formula injection or opening CSV files in applications that do not automatically execute formulas.